Integration Service user guide

DELIVERY:

Last updated Oct 14, 2025

Amazon Web Services authentication

Prerequisites

To create a connection, you need to provide the following credentials:

For Access Key authentication method:
- Access key ID (the access key used to connect to Amazon Web Services)
- Secret access key (the secret key used to connect to Amazon Web Services)
- Temporary session token (used to create the AWS client session)
- Region (specifies the AWS Region to connect to)
For Access key assume role authentication method:
- Access key ID (the access key used to connect to Amazon Web Services)
- Secret access key (the secret key used to connect to Amazon Web Services)
- IAM role (specifies the name of the IAM role)
- Temporary session token (used to create the AWS client session)
- Region (specifies the AWS Region to connect to)
For UiPath Managed Cross-Account Assume Role authentication method:
- IAM role ARN
- External ID
- Region (specifies the AWS Region to connect to)

Creating an Access key assume role connection

To create an Access key assume role connection, first follow these steps:

Navigate to AWS console > IAM > Role.
Select Create Role.
Select Custom Trust Policy.
Attach the custom trust policy, as shown in the following code section:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "<user ARN>"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "<user ARN>"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```
Add the permissions needed to be assigned to the user.
Fill all the required details and then select Create.
The UiPath Robot running the automation must be deployed in an AWS EC2 instance to which the specified IAM Role is attached, as described here.

Creating a UiPath Managed Cross-Account Assume Role connection

This type of connection uses temporary STS credentials instead of long-term IAM keys to securely access AWS resources (S3, EC2, DynamoDB, Bedrock). You only need to provide minimal inputs and complete a one-time AWS account setup, no IAM access keys or secrets required.

UiPath will create and manage a different IAM user per customer, guaranteeing that the AWS access will be isolated at the UiPath organisation level.

Note:

This authentication method supports only one role per customer. You can use the role to create multiple connections, but you cannot create multiple IAM roles for multiple connections.

To create a connection:

Provide the ARN of the IAM Role that UiPath should assume.
This Role ARN will be incorporated into an IAM user's permissions policy. The IAM user is created and managed by UiPath specifically and isolated for each customer.

Configure IAM role's trust policy.

Update the IAM Role trust policy to allow assumption by UiPath’s IAM user.

UiPath will share the ARN of its IAM user created specifically for your customer account.
You must add the UiPath IAM user ARN into the Principal element of the role’s trust policy.

We require an External ID as an extra safety safeguard in third-party access scenarios and to help prevent the confused deputy problem. This can be any string of your choosing. To configure it, add a condition with sts:ExternalId as in the example below. The External Id is passed to UiPath during the actual Integration Service connection creation.

Example policy format:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "<UiPath IAM user ARN>"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "<your External Id>"
                }
            }
        }
    ]
}{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "<UiPath IAM user ARN>"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "<your External Id>"
                }
            }
        }
    ]
}

Configure IAM role’s permission policies.
For example:
- S3: List/Get/Put on specific buckets.
- Bedrock: InvokeModel, InvokeModelWithResponseStream.
Important:
The IAM role must be granted the minimum set of permissions required for your specific use case. For example, if the use case involves reading objects from an S3 bucket, the role should only have read-only access to that specific bucket. A sample policy for such a use case would look as follows:
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ]
    }
  ]
}{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::your-bucket-name",
        "arn:aws:s3:::your-bucket-name/*"
      ]
    }
  ]
}
```
Add the Amazon Web Services connection in Integration Service.

Add the connection

To create a connection to your Amazon Web Services instance, you need to perform the following steps:

Select Integration Service from the left rail.
From the Connectors list, select Amazon Web Services. You can also use the search bar to narrow down the connector.
Select the Connect to Amazon Web Services button.
From the Authentication Type field, select one of the three options: Access key, Access key assume role, or UiPath Managed Cross Account Assume Role. By default, Access key is selected.
Enter the required credentials for your preferred authentication method and select Connect.
Your connection has been added.